CVE-2025-32986

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint...

CVE-2025-2291

Password can be used past expiry in PgBouncer due to authquery not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password...

CVE-2025-32986

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint...

CVE-2025-32986

NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint...

CVE-2025-46275

WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials...

CVE-2025-32730

The CVE-2025-32730 entry affects i-PRO Configuration Tool used with i-PRO Co., Ltd. surveillance cameras/recorders. The root cause is use of a hard-coded cryptographic key (CWE-321) that enables a local authenticated attacker to leverage authentication data from the last connected cameras/recorde...

PT-2025-17725 · Franka Robotics · Franka Emika Robot

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An issue exists due to an improper authentication mechanism, allowing an unauthenticated remote attacker to enumerate valid usernames. Recommendations: At the moment, there is no information...

The vulnerability of the SSH plugin of the JetBrains Toolbox, a set of development tools, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the SSH plugin of the JetBrains Toolbox developer’s tools is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

PT-2025-17619 · Microsoft · Azure Ad Authentication

Name of the Vulnerable Software and Affected Versions: Microsoft Azure AD Authentication affected versions not specified Description: The issue concerns Microsoft Azure AD Authentication. No specific details about the nature of the issue are provided, but it is mentioned that more information, su...

The vulnerability of the Authenticate method in software for managing and monitoring remote objects in telemetry and telemechanics systems, allowing a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Authenticate method in software for managing and monitoring remote objects in telemetry and telemechanics systems related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the...

CVE-2025-28038

TOTOLINK EX1200T V4.1.2cu.5232B20210713 was found to contain a pre-auth remote command execution vulnerability in the setWebWlanIdx function through the webWlanIdx parameter...

CVE-2025-2594

The CVE-2025-2594 affects the WordPress plugin “User Registration & Membership” prior to version 4.1.3. Affected behavior: when the Membership Addon is enabled, data in an AJAX action is not properly validated, enabling an attacker to authenticate as any user (including administrators) by supplyi...

CVE-2025-2987 IBM Maximo Asset Management server-side request forgery

IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2025-2987

IBM Maximo Asset Management 7.6.1.3 is vulnerable to Server-Side Request Forgery (SSRF). An authenticated attacker may cause the system to issue unauthorized requests, potentially enabling network enumeration or other attacks. The IBM security bulletin assigns CVE-2025-2987 with a CVSS v3.1 base ...

CVE-2025-32377 Rasa Pro Missing Authentication For Voice Connector APIs

Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models LLMs. A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the...

Path Traversal

umbraco.cms is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths in the management API, allowing authenticated users to upload files to unintended locations...

📄 Tatsu 3.3.11 Remote Code Execution

Tatsu versions 3.3.11 and below pre-authentication proof of concept remote code execution exploit. !/usr/bin/python3 coding: utf-8 Exploit Title:Tatsu = 3.3.11 pre-auth RCE exploit Date: 2025-04-16 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H:...

GHSA-7XQ5-54JP-2MFG Rasa Pro Missing Authentication For Voice Connector APIs

Vulnerability A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticate...

CVE-2025-43013

In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible...

CVE-2025-31380 WordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerability

Weak Password Recovery Mechanism for Forgotten Password vulnerability in videowhisper Paid Videochat Turnkey Site allows Password Recovery Exploitation. This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.11...